Strip proprietary enterprise code from published images

enterprise/LICENSE.md forbids redistribution without a BerriAI
subscription; the rest of LiteLLM is MIT. Remove the litellm-enterprise
package and /app/enterprise so the published images are MIT-only, and
smoke-check that the proxy still imports without them (all litellm
imports of litellm_enterprise are ImportError-guarded).

Author: dan2k3k4

Dockerfile

@@ -5,16 +5,24 @@ ARG LITELLM_IMAGE=ghcr.io/berriai/litellm
 ARG LITELLM_VERSION=v1.93.0
 FROM ${LITELLM_IMAGE}:${LITELLM_VERSION}
 
-# Apply patch/*.patch onto the installed litellm package. Only litellm/*
-# paths are applied — tests/ and ui/ sources in a patch are skipped (the
-# image ships prebuilt UI assets, so ui/ source changes are inert anyway).
-# With no *.patch files present this is a no-op and the image is a 1-to-1
-# copy of upstream.
+# 1. Strip the proprietary enterprise code (enterprise/LICENSE.md forbids
+#    redistribution without a BerriAI subscription; everything else is MIT,
+#    which allows republishing). All litellm imports of litellm_enterprise
+#    are ImportError-guarded, and we never set LITELLM_LICENSE, so nothing
+#    is lost. This runs even with an empty patch/ dir — republishing the
+#    unmodified image would otherwise still redistribute enterprise code.
+# 2. Apply patch/*.patch onto the installed litellm package. Only litellm/*
+#    paths are applied — tests/ and ui/ sources in a patch are skipped (the
+#    image ships prebuilt UI assets, so ui/ source changes are inert anyway).
+# 3. Import the proxy server as a smoke test that the image still boots
+#    without the enterprise code and with the patches applied.
 COPY patch/ /tmp/patch/
 RUN set -e; \
+    pip uninstall -y litellm-enterprise; \
+    rm -rf /app/enterprise; \
+    cd "$(python -c 'import site; print(site.getsitepackages()[0])')"; \
     if ls /tmp/patch/*.patch >/dev/null 2>&1; then \
         apk add --no-cache git; \
-        cd "$(python -c 'import site; print(site.getsitepackages()[0])')"; \
         for p in /tmp/patch/*.patch; do \
             echo "=== applying $p ==="; \
             git apply --verbose --include='litellm/*' "$p"; \
@@ -23,4 +31,6 @@ RUN set -e; \
         python -m compileall -q litellm; \
         apk del git; \
     fi; \
-    rm -rf /tmp/patch
+    rm -rf /tmp/patch; \
+    python -c 'import litellm.proxy.proxy_server' \
+        && echo "proxy_server imports OK without enterprise code"

README.md

@@ -1,8 +1,12 @@
 # litellm-lagoon-base
 
 Republishes the upstream [LiteLLM](https://github.com/BerriAI/litellm) proxy
-images with our pending upstream patches applied — nothing else. With an empty
-`patch/` dir the output is a 1-to-1 copy of upstream.
+images with our pending upstream patches applied and the proprietary
+`enterprise/` code removed — nothing else. LiteLLM is MIT-licensed **except**
+the enterprise components, whose license forbids redistribution without a
+BerriAI subscription, so the published images contain MIT-licensed code only.
+With an empty `patch/` dir the output is a 1-to-1 copy of upstream minus
+those enterprise components.
 
 Two packages, mirroring the upstream image variants, tagged with the upstream
 release (e.g. `v1.93.0`) plus `latest`:
@@ -14,10 +18,14 @@ release (e.g. `v1.93.0`) plus `latest`:
 
 ## How it works
 
-- `Dockerfile` starts `FROM ${LITELLM_IMAGE}:${LITELLM_VERSION}` and applies
+- `Dockerfile` starts `FROM ${LITELLM_IMAGE}:${LITELLM_VERSION}`, removes the
+  enterprise code (`litellm-enterprise` package + `/app/enterprise` — all
+  litellm imports of it are ImportError-guarded and features are dormant
+  without `LITELLM_LICENSE`, so nothing functional is lost), and applies
   every `patch/*.patch` onto the installed `litellm` site-package with
   `git apply --include='litellm/*'` (tests/UI-source paths in a patch are
-  skipped — the images ship prebuilt UI assets).
+  skipped — the images ship prebuilt UI assets). A final
+  `import litellm.proxy.proxy_server` smoke-checks the result.
 - `.github/workflows/build.yml` runs once a day, resolves the latest
   **stable** (non-prerelease) LiteLLM release, and builds/pushes both variants
   if not already published. Pushes to `main` touching `Dockerfile` or `patch/`
@@ -47,7 +55,8 @@ git diff > <this-repo>/patch/0001-litellm-pr31618-budget-threshold-webhook-alert
 ## When the PR merges upstream
 
 Delete `patch/*.patch` (keep `patch/.gitkeep`) and push. Builds continue and
-publish unpatched 1-to-1 copies of upstream — consumers keep working unchanged.
+publish unpatched copies of upstream (still enterprise-stripped) — consumers
+keep working unchanged.
 
 ## Consuming the internal packages